Legal · Effective September 26, 2026
Sub-processors
These are the third parties that process personal data on our behalf to run CaptivaHQ and this website. Each is bound by a written agreement that requires protection at least equivalent to our Data Processing Agreement and forbids it from using your data for its own purposes.
1. Platform sub-processors
These providers host or operate the CaptivaHQ product and may process Customer Data.
| Sub-processor | Purpose | Data processed | Location |
|---|---|---|---|
| Dedicated infrastructure provider | Application servers, PostgreSQL databases, cache and the self-hosted search service for each regional cell | All Customer Data in the cell: records, documents, transcripts, embeddings, sessions | United States (Virginia) for the US cell; Germany (Nuremberg) for the EU cell |
| Google Cloud (Google LLC) | Object storage for attachments; secret management; AI model inference and embeddings; live voice | Files and documents; encrypted credentials; record content, email text, documents, images and voice sent to AI Features | United States and European Union, matching the customer's cell where the service allows |
| Scaleway SAS | Platform directory: the master database of tenants and users | Tenant and user identities, sign-in tokens, authentication audit trail. No customer records. | France (Paris) |
| Amazon Web Services, Inc. | Transactional email (sign-in codes, notifications, invitations) | Recipient address and message content | United States |
| Stripe, Inc. | Subscription billing, payment processing and AI credit purchases | Billing contact, company and tax details, payment card data (held by Stripe, never by us), invoices | United States |
| Cloudflare, Inc. | DNS for the product domains | None (DNS records only) | Global |
2. Services used when AI Features look outward
Some features send limited data to public services so they can work. They can be switched off per workspace in Settings.
| Service | Used by | Data sent |
|---|---|---|
| Public web-search engines (through our self-hosted search service) | Company and contact enrichment, web-grounded answers | Company and person names used as search queries |
| Public geocoding and routing services | Maps, scheduling and route planning | Addresses |
| Map tile provider | Map display | Map viewport coordinates only |
3. This website (captivahq.com)
| Provider | Purpose | Data processed | Location |
|---|---|---|---|
| Google Cloud Storage | Hosting the website's files | Standard request logs | United States |
| Cloudflare, Inc. | Content delivery, DNS, Turnstile anti-abuse check on the registration form | IP address, browser characteristics, request logs | Global |
| Google Analytics 4 and Google Ads | Visit measurement and advertising attribution — only after you accept cookies | See the Cookie Policy | United States |
| Google Firebase (Cloud Functions) | Receiving registration-form submissions and emailing them to our team; nothing is stored | The fields you enter on the form | United States |
4. Services you connect
When you connect Google Workspace, Microsoft 365, Zoom, Microsoft Teams, Fathom, Fireflies, Otter or another integration, that provider is your vendor, not our sub-processor: you hold the agreement with it, and we receive data from it at your instruction.
5. Changes to this list
We will give at least 30 days' notice before a new sub-processor starts processing Customer Data, by updating this page and emailing workspace owners who have asked for notices at [email protected]. You may object on reasonable data-protection grounds within that period, as described in the DPA. In an emergency affecting security or availability we may make a change sooner and notify you promptly afterwards.
Published for CaptivaHQ by United Technology Services Inc. · All documents: captivahq.com/legal. Questions: [email protected].